---
id: CVE-2024-5148
title: >-
  Gnome-remote-desktop: inadequate validation of session agents using d-bus
  methods may expose rdp tls certificate
summary: >-
  A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop
  system daemon performs inadequate validation of session agents using D-Bus
  methods related to transitioning a client connection from the login screen to
  the u…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-488
vendor: Red Hat
product: gnome-remote-desktop
affected:
  - gnome-remote-desktop >= 46.alpha < 46.2
  - gnome-remote-desktop
  - gnome-remote-desktop
  - gnome-remote-desktop
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2024-09-03T15:27:26.435046Z'
published: '2024-09-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T13:43:48.526Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-5148'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2024-5148'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2282003'
    label: RHBZ#2282003
  - url: 'https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/196'
tags:
  - cve.org
epss: 0.00569
epssPercentile: 0.47381
ingestedAt: '2026-11-05T21:36:00.850Z'
---

## Overview

A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.

## Affected

- `gnome-remote-desktop >= 46.alpha < 46.2`
- `gnome-remote-desktop`
- `gnome-remote-desktop`
- `gnome-remote-desktop`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.